Honor Photo Module CVE-2025-57839

Exploitation requires LOCAL access to the device (CVSS AV:L) - realistically a malicious, compromised, or over-privileged application already running on the affected Honor device that can reach the Photo module. The vendor description does not name a specific feature toggle, protocol, or non-default configuration, so no special setting is confirmed as required; the primary limiting factor is the need for prior on-device code execution, which rules out remote or network-based exploitation and confines the risk to locally-present attackers. Impact is limited to confidentiality disclosure (C:L; no integrity or availability effect).

All available signals converge on this being a LOW real-world priority rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a local-only information disclosure with no integrity or availability impact and only Low confidentiality impact; note that this vector computes to a 3.3 base score, yet the input lists 4.0 - the 4.0 likely reflects a CVSS 4.0 scoring or vendor rounding, so treat the numeric discrepancy as a labeling difference, not a severity conflict. EPSS reinforces low urgency at 0.18% (7th percentile), indicating very low near-term exploitation likelihood. There is no CISA KEV listing and no public exploit code, so there is no evidence of active or imminent exploitation. The key limiting factor is the Local attack vector: an attacker needs to already be executing code on the device (e.g., via a malicious or co-located app), which substantially constrains the threat surface. The most significant data gap is the vague vendor description ('Photo module is affected by information leak') - it does not name the exact leaked data, interface, or precondition, so the precise impact cannot be independently confirmed from the input.

A user installs a malicious or over-privileged third-party application on an affected Honor device. That locally-running app interacts with the Photo module and obtains confidential image-related data it should not be able to access, disclosing it to the attacker. No public exploit code exists, and the Local attack vector with Low complexity means the scenario requires prior code execution on the device rather than remote access.